I 

114TH CONGRESS 

1ST SESSION H. R. 4187 

To require certain entities who collect and maintain personal information 

of individuals to secure such information and to provide notice to such 

individuals in the case of a breach of security involving such information, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

DECEMBER 8, 2015 

Ms. SCHAKOWSKY (for herself, Mr. PALLONE, Mr. RUSH, Mr. TONKO, Mr. 

WELCH, Mr. KENNEDY, Mr. SARBANES, and Mr. BUTTERFIELD) introduced the following bill; which was referred to the Committee on Energy 

and Commerce 

A BILL 

To require certain entities who collect and maintain personal 

information of individuals to secure such information 

and to provide notice to such individuals in the case 

of a breach of security involving such information, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Secure and Protect 

5 Americans’ Data Act’’. 


emcdonald on DSK67QTVN1PROD with BILLS
2 

•HR 4187 IH

1 SEC. 2. REQUIREMENTS FOR INFORMATION SECURITY. 

2 (a) GENERAL SECURITY POLICIES AND PROCE3 DURES.— 

4 (1) REGULATIONS.—Not later than 1 year after 

5 the date of enactment of this Act, the Commission 

6 shall promulgate regulations under section 553 of 

7 title 5, United States Code, to require each covered 

8 entity to establish and implement reasonable policies 

9 and procedures regarding information security prac10 tices for the treatment and protection of personal in11 formation taking into consideration— 

12 (A) the size of, and the nature, scope, and 

13 complexity of the activities engaged in by such 

14 covered entity; 

15 (B) the sensitivity of any personal informa16 tion at issue; 

17 (C) the current state of the art in adminis18 trative, technical, and physical safeguards for 

19 protecting such information; and 

20 (D) the cost of implementing such safe21 guards. 

22 (2) REQUIREMENTS.—Such regulations shall 

23 require the policies and procedures to include the 

24 following: 


emcdonald on DSK67QTVN1PROD with BILLS
3 

•HR 4187 IH

1 (A) A written security policy with respect 

2 to the collection, use, sale, other dissemination, 

3 and maintenance of such personal information. 

4 (B) The identification of an officer or 

5 other individual as the point of contact with re6 sponsibility for the management of information 

7 security. 

8 (C) A process for identifying and assessing 

9 any reasonably foreseeable vulnerabilities in the 

10 system or systems maintained by such covered 

11 entity that contains such data, which shall in12 clude regular monitoring for a breach of secu13 rity of such system or systems. 

14 (D) A process for taking preventive and 

15 corrective action to mitigate against any 

16 vulnerabilities identified in the process required 

17 by subparagraph (C), which may include imple18 menting any changes to security practices and 

19 the architecture, installation, or implementation 

20 of network or operating software, and for regu21 larly testing or otherwise monitoring the effec22 tiveness of the safeguards’ key controls, sys23 tems, and procedures. 

24 (E) A process for disposing of data con25 taining personal information by shredding, perVerDate Sep 11 2014 05:05 Dec 09, 2015 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H4187.IH H4187

emcdonald on DSK67QTVN1PROD with BILLS
4 

•HR 4187 IH

1 manently erasing, or otherwise modifying the 

2 personal information contained in such data to 

3 make such personal information permanently 

4 unreadable or undecipherable. 

5 (F) A process for overseeing persons to 

6 whom personal information is disclosed, or who 

7 have access to Internet-connected devices, by— 

8 (i) taking reasonable steps to select 

9 and retain persons that are capable of 

10 maintaining appropriate safeguards for the 

11 personal information or Internet-connected 

12 devices at issue; and 

13 (ii) requiring all such persons to im14 plement and maintain such security meas15 ures. 

16 (G) A process for employee training and 

17 supervision for implementation of the policies 

18 and procedures required by this subsection. 

19 (3) PERIODIC ASSESSMENT AND CONSUMER

20 PRIVACY AND DATA SECURITY MODERNIZATION.— 

21 Not less than every 12 months, each covered entity 

22 shall monitor, evaluate, and adjust, as appropriate, 

23 the consumer privacy and data security program of 

24 such covered entity in light of any relevant changes 

25 in— 


emcdonald on DSK67QTVN1PROD with BILLS
5 

•HR 4187 IH

1 (A) technology; 

2 (B) internal or external threats and 

3 vulnerabilities to personal information; and 

4 (C) the changing business arrangements of 

5 the covered entity, such as— 

6 (i) mergers and acquisitions; 

7 (ii) alliances and joint ventures; 

8 (iii) outsourcing arrangements; 

9 (iv) bankruptcy; and 

10 (v) changes to personal information 

11 systems. 

12 (4) TREATMENT OF ENTITIES GOVERNED BY

13 OTHER FEDERAL LAW.—Any covered entity who is 

14 in compliance with any other Federal law that re15 quires such covered entity to maintain standards 

16 and safeguards for information security and protec17 tion of personal information that, taken as a whole 

18 and as the Commission shall determine in the rule19 making required under this subsection, requires cov20 ered entities to provide protections substantially 

21 similar to, or greater than, those required under this 

22 subsection, shall be deemed to be in compliance with 

23 this subsection. 

24 (b) SPECIAL REQUIREMENTS FOR INFORMATION

25 BROKERS.— 


emcdonald on DSK67QTVN1PROD with BILLS
6 

•HR 4187 IH

1 (1) SUBMISSION OF POLICIES TO THE FTC.— 

2 The regulations promulgated under subsection (a) 

3 shall require each information broker to submit its 

4 security policies to the Commission in conjunction 

5 with a notification of a breach of security under sec6 tion 3 or upon request of the Commission. 

7 (2) POST-BREACH AUDIT.—For any information 

8 broker required to provide notification under section 

9 3, the Commission may conduct audits of the infor10 mation security practices of such information broker, 

11 or require the information broker to conduct inde12 pendent audits of such practices (by an independent 

13 auditor who has not audited such information bro14 ker’s security practices during the preceding 5 

15 years). 

16 (3) ACCURACY OF AND INDIVIDUAL ACCESS TO

17 PERSONAL INFORMATION.— 

18 (A) ACCURACY.— 

19 (i) IN GENERAL.—Each information 

20 broker shall establish reasonable proce21 dures to assure the maximum possible ac22 curacy of the personal information the in23 formation broker collects, assembles, or 

24 maintains, and any other information the 

25 information broker collects, assembles, or 


emcdonald on DSK67QTVN1PROD with BILLS
7 

•HR 4187 IH

1 maintains that specifically identifies an in2 dividual, other than information which 

3 merely identifies an individual’s name or 

4 address. 

5 (ii) LIMITED EXCEPTION FOR FRAUD

6 DATABASES.—The requirement in clause 

7 (i) shall not prevent the collection or main8 tenance of information that may be inac9 curate with respect to a particular indi10 vidual when that information is being col11 lected or maintained solely— 

12 (I) for the purpose of indicating 

13 whether there may be a discrepancy 

14 or irregularity in the personal infor15 mation that is associated with an indi16 vidual; and 

17 (II) to help identify, or authen18 ticate the identity of, an individual, or 

19 to protect against or investigate fraud 

20 or other unlawful conduct. 

21 (B) CONSUMER ACCESS TO INFORMA22 TION.—Each information broker shall— 

23 (i) provide to each individual whose 

24 personal information the information 

25 broker maintains, at the individual’s reVerDate Sep 11 2014 05:05 Dec 09, 2015 Jkt 059200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H4187.IH H4187

emcdonald on DSK67QTVN1PROD with BILLS
8 

•HR 4187 IH

1 quest at least once per year and at no cost 

2 to the individual, and after verifying the 

3 identity of such individual, a means for the 

4 individual to review any personal informa5 tion regarding such individual maintained 

6 by the information broker and any other 

7 information maintained by the information 

8 broker that specifically identifies such indi9 vidual, other than information which mere10 ly identifies an individual’s name or ad11 dress; and 

12 (ii) place a conspicuous notice on the 

13 Internet website of the information broker 

14 (if the information broker maintains such 

15 a website) instructing individuals how to 

16 request access to the information required 

17 to be provided under clause (i), and, as ap18 plicable, how to express a preference with 

19 respect to the use of personal information 

20 for marketing purposes under subpara21 graph (D). 

22 (C) DISPUTED INFORMATION.—Whenever 

23 an individual whose information the information 

24 broker maintains makes a written request dis25 puting the accuracy of any such information, 


emcdonald on DSK67QTVN1PROD with BILLS
9 

•HR 4187 IH

1 the information broker, after verifying the iden2 tity of the individual making such request and 

3 unless there are reasonable grounds to believe 

4 such request is frivolous or irrelevant, shall— 

5 (i) correct any inaccuracy; or 

6 (ii) in the case of information that 

7 is— 

8 (I) public record information, in9 form the individual of the source of 

10 the information, and, if reasonably 

11 available, where a request for correc12 tion may be directed and, if the indi13 vidual provides proof that the public 

14 record has been corrected or that the 

15 information broker was reporting the 

16 information incorrectly, correct the in17 accuracy in the information broker’s 

18 records; or 

19 (II) nonpublic information, note 

20 the information that is disputed, in21 cluding the individual’s statement dis22 puting such information, and take 

23 reasonable steps to independently 

24 verify such information under the pro25 cedures outlined in subparagraph (A) 


emcdonald on DSK67QTVN1PROD with BILLS
10 

•HR 4187 IH

1 if such information can be independ2 ently verified. 

3 (D) ALTERNATIVE PROCEDURE FOR CER4 TAIN MARKETING INFORMATION.—In accord5 ance with regulations issued under subpara6 graph (F), an information broker that main7 tains any information described in subpara8 graph (A) which is used, shared, or sold by 

9 such information broker for marketing pur10 poses, may, in lieu of complying with the access 

11 and dispute requirements set forth in subpara12 graphs (B) and (C), provide each individual 

13 whose information the information broker main14 tains with a reasonable means of expressing a 

15 preference not to have his or her information 

16 used for such purposes. If the individual ex17 presses such a preference, the information 

18 broker may not use, share, or sell the individ19 ual’s information for marketing purposes. 

20 (E) LIMITATIONS.—An information broker 

21 may limit the access to information required 

22 under subparagraph (B)(i) and is not required 

23 to provide notice to individuals as required 

24 under subparagraph (B)(ii) in the following cir25 cumstances: 


emcdonald on DSK67QTVN1PROD with BILLS
11 

•HR 4187 IH

1 (i) If access of the individual to the 

2 information is limited by law or legally rec3 ognized privilege. 

4 (ii) If the information is used for a le5 gitimate governmental or fraud prevention 

6 purpose that would be compromised by 

7 such access. 

8 (iii) If the information consists of a 

9 published media record, unless that record 

10 has been included in a report about an in11 dividual shared with a third party. 

12 (F) RULEMAKING.—Not later than 1 year 

13 after the date of enactment of this Act, the 

14 Commission shall promulgate regulations under 

15 section 553 of title 5, United States Code, to 

16 carry out this paragraph and to facilitate the 

17 purposes of this Act. In addition, the Commis18 sion shall issue regulations, as necessary, under 

19 section 553 of title 5, United States Code, on 

20 the scope of the application of the limitations in 

21 subparagraph (E), including any additional cir22 cumstances in which an information broker may 

23 limit access to information under such clause 

24 that the Commission determines to be appro25 priate. 


emcdonald on DSK67QTVN1PROD with BILLS
12 

•HR 4187 IH

1 (G) FCRA REGULATED PERSONS.—Any 

2 information broker who is engaged in activities 

3 subject to the Fair Credit Reporting Act and 

4 who is in compliance with sections 609, 610, 

5 and 611 of such Act (15 U.S.C. 1681g; 1681h; 

6 1681i) with respect to information subject to 

7 such Act, shall be deemed to be in compliance 

8 with this paragraph with respect to such infor9 mation. 

10 (4) REQUIREMENT OF AUDIT LOG OF ACCESSED

11 AND TRANSMITTED INFORMATION.—Not later than 

12 1 year after the date of enactment of this Act, the 

13 Commission shall promulgate regulations under sec14 tion 553 of title 5, United States Code, to require 

15 information brokers to establish measures which fa16 cilitate the auditing or retracing of any internal or 

17 external access to, or transmissions of, any data con18 taining personal information collected, assembled, or 

19 maintained by such information broker. 

20 (5) PROHIBITION ON PRETEXTING BY INFOR21 MATION BROKERS.— 

22 (A) PROHIBITION ON OBTAINING PER23 SONAL INFORMATION BY FALSE PRETENSES.— 

24 It shall be unlawful for an information broker 

25 to obtain or attempt to obtain, or cause to be 


emcdonald on DSK67QTVN1PROD with BILLS
13 

•HR 4187 IH

1 disclosed or attempt to cause to be disclosed to 

2 any person, personal information or any other 

3 information relating to any person by— 

4 (i) making a false, fictitious, or fraud5 ulent statement or representation to any 

6 person; or 

7 (ii) providing any document or other 

8 information to any person that the infor9 mation broker knows or should know to be 

10 forged, counterfeit, lost, stolen, or fraudu11 lently obtained, or to contain a false, ficti12 tious, or fraudulent statement or represen13 tation. 

14 (B) PROHIBITION ON SOLICITATION TO

15 OBTAIN PERSONAL INFORMATION UNDER FALSE

16 PRETENSES.—It shall be unlawful for an infor17 mation broker to request a person to obtain 

18 personal information or any other information 

19 relating to any other person, if the information 

20 broker knew or should have known that the per21 son to whom such a request is made will obtain 

22 or attempt to obtain such information in the 

23 manner described in subparagraph (A). 


emcdonald on DSK67QTVN1PROD with BILLS
14 

•HR 4187 IH

1 SEC. 3. NOTIFICATION OF INFORMATION SECURITY 

2 BREACH. 

3 (a) INDIVIDUAL NOTIFICATION.— 

4 (1) IN GENERAL.—Each covered entity shall, 

5 following the discovery of a breach of security, notify 

6 each individual who is a citizen or resident of the 

7 United States whose personal information was, or is 

8 reasonably believed to have been, acquired or 

9 accessed by an unauthorized person, or used for an 

10 unauthorized purpose. 

11 (2) TIMELINESS OF NOTIFICATION.— 

12 (A) IN GENERAL.—Unless subject to a 

13 delay authorized under subparagraph (B), a no14 tification required under paragraph (1) shall be 

15 made as expeditiously as practicable and with16 out unreasonable delay, but not later than 30 

17 days following the discovery of a breach of secu18 rity. 

19 (B) DELAY OF NOTIFICATION AUTHORIZED

20 FOR LAW ENFORCEMENT OR NATIONAL SECU21 RITY PURPOSES.— 

22 (i) LAW ENFORCEMENT.—If a Fed23 eral or State law enforcement agency, in24 cluding an attorney general of a State, de25 termines that the notification required 

26 under this section would impede a civil or 


emcdonald on DSK67QTVN1PROD with BILLS
15 

•HR 4187 IH

1 criminal investigation, such notification 

2 shall be delayed upon the written request 

3 of the law enforcement agency for 30 days 

4 or such lesser period of time which the law 

5 enforcement agency determines is reason6 ably necessary and requests in writing. 

7 Such a law enforcement agency may, by a 

8 subsequent written request, revoke such 

9 delay or extend the period of time set forth 

10 in the original request made under this 

11 paragraph if further delay is necessary. 

12 (ii) NATIONAL SECURITY.—If a Fed13 eral national security agency or homeland 

14 security agency determines that the notifi15 cation required under this section would 

16 threaten national or homeland security, 

17 such notification may be delayed for a pe18 riod of time of up to 60 days which the na19 tional security agency or homeland security 

20 agency determines is reasonably necessary 

21 and requests in writing. A Federal national 

22 security agency or homeland security agen23 cy may revoke such delay or extend the pe24 riod of time set forth in the original re25 quest made under this paragraph by a subVerDate Sep 11 2014 05:05 Dec 09, 2015 Jkt 059200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\H4187.IH H4187

emcdonald on DSK67QTVN1PROD with BILLS
16 

•HR 4187 IH

1 sequent written request if further delay is 

2 necessary. 

3 (b) COORDINATION OF NOTIFICATION WITH CON4 SUMER REPORTING AGENCIES.—If a covered entity is re5 quired to provide notification to more than 5,000 individ6 uals under subsection (a)(1), the covered entity shall also 

7 notify the major consumer reporting agencies that compile 

8 and maintain files on consumers on a nationwide basis, 

9 of the timing and distribution of the notifications. Such 

10 notification shall be given to the consumer reporting agen11 cies without unreasonable delay and, if such notification 

12 will not delay notification to the affected individuals, prior 

13 to the distribution of notifications to the affected individ14 uals. 

15 (c) METHOD AND CONTENT OF NOTIFICATION.— 

16 (1) GENERAL NOTIFICATION.—A covered entity 

17 required to provide notification to individuals under 

18 subsection (a)(1) shall be in compliance with such 

19 requirement if the covered entity provides con20 spicuous and clearly identified notification by one of 

21 the following methods (provided the selected method 

22 can reasonably be expected to reach the intended in23 dividual): 


emcdonald on DSK67QTVN1PROD with BILLS
17 

•HR 4187 IH

1 (A) Written notification to the last known 

2 home mailing address of the individual in the 

3 records of the covered entity. 

4 (B) Notification by email or other elec5 tronic means, if— 

6 (i) the covered entity’s primary meth7 od of communication with the individual is 

8 by email or such other electronic means; or 

9 (ii) the individual has consented to re10 ceive such notification and the notification 

11 is provided in a manner that is consistent 

12 with the provisions permitting electronic 

13 transmission of notifications under section 

14 101 of the Electronic Signatures in Global 

15 Commerce Act (15 U.S.C. 7001). 

16 (2) WEBSITE NOTIFICATION.—The covered en17 tity shall also provide conspicuous notification on the 

18 Internet website of the covered entity (if such cov19 ered entity maintains such a website) for a period of 

20 not less than 90 days. 

21 (3) MEDIA NOTIFICATION.—If the number of 

22 residents of a State whose personal information was, 

23 or is reasonably believed to have been acquired or 

24 accessed by an unauthorized person, or used for an 

25 unauthorized purpose exceeds 5,000, the covered enVerDate Sep 11 2014 05:05 Dec 09, 2015 Jkt 059200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\H4187.IH H4187

emcdonald on DSK67QTVN1PROD with BILLS
18 

•HR 4187 IH

1 tity shall also provide notification in print and to 

2 broadcast media, including major media in metro3 politan and rural areas where the individuals whose 

4 personal information was, or is reasonably believed 

5 to have been, acquired or accessed by an unauthor6 ized person, or used for an unauthorized purpose, 

7 reside. 

8 (4) CONTENT OF NOTIFICATION.— 

9 (A) IN GENERAL.—Regardless of the 

10 method by which notification is provided to an 

11 individual under paragraphs (1), (2), and (3), 

12 such notification shall include— 

13 (i) a description of the personal infor14 mation that was, or is reasonably believed 

15 to have been, acquired or accessed by an 

16 unauthorized person, or used for an unau17 thorized purpose; 

18 (ii) a general description of the inci19 dent and the date or estimated date of the 

20 security breach and the date range during 

21 which the personal information was com22 promised; 

23 (iii) the acts the covered entity, or the 

24 agent of the covered entity, has taken to 


emcdonald on DSK67QTVN1PROD with BILLS
19 

•HR 4187 IH

1 protect personal information from further 

2 security breach; 

3 (iv) a telephone number that the indi4 vidual may use, at no cost to such indi5 vidual, to contact the covered entity, or 

6 agent of the covered entity, to inquire 

7 about the breach of security or the infor8 mation the covered entity maintained 

9 about that individual; 

10 (v) notification that the individual is 

11 entitled to receive, at no cost to such indi12 vidual, consumer credit reports on a quar13 terly basis for a period of 2 years, or credit 

14 monitoring or other service that enables 

15 consumers to detect the misuse of their 

16 personal information for a period of 2 

17 years, and instructions to the individual on 

18 requesting such reports or service from the 

19 covered entity, except when the only infor20 mation which has been the subject of the 

21 security breach is the individual’s first 

22 name or initial and last name, or address, 

23 or phone number, in combination with a 

24 credit or debit card number, and any re25 quired security code; 


emcdonald on DSK67QTVN1PROD with BILLS
20 

•HR 4187 IH

1 (vi) the toll-free contact telephone 

2 numbers and addresses for the major con3 sumer reporting agencies; and 

4 (vii) a toll-free telephone number and 

5 Internet website address for the Commis6 sion whereby the individual may obtain in7 formation regarding identity theft. 

8 (B) DIRECT BUSINESS RELATIONSHIP.— 

9 The notification required under subsection (a) 

10 shall identify the covered entity that has a di11 rect business relationship with the individual. 

12 (5) REGULATIONS FOR SUBSTITUTE NOTIFICA13 TION.—Not later than 1 year after the date of en14 actment of this Act, the Commission shall, by regu15 lation under section 553 of title 5, United States 

16 Code— 

17 (A) establish criteria for determining cir18 cumstances under which substitute notification 

19 may be provided in lieu of direct notification re20 quired by paragraph (1), including criteria for 

21 determining if notification under paragraph (1) 

22 is not feasible due to excessive costs to the cov23 ered entity required to provide such notification 

24 relative to the resources of such covered entity; 

25 and 


emcdonald on DSK67QTVN1PROD with BILLS
21 

•HR 4187 IH

1 (B) establish the form and content of sub2 stitute notification. 

3 (d) NOTIFICATION FOR LAW ENFORCEMENT AND

4 OTHER PURPOSES.—A covered entity shall, as expedi5 tiously as practicable and without unreasonable delay, but 

6 not later than 10 days following the discovery of a breach 

7 of security, provide notification of the breach to— 

8 (1) the Commission; 

9 (2) the Federal Bureau of Investigation; 

10 (3) the Secret Service; 

11 (4) for common carriers, the Federal Commu12 nications Commission; and 

13 (5) the attorney general of each State in which 

14 the personal information of a resident or residents 

15 of the State was, or is reasonably believed to have 

16 been, acquired or accessed by an unauthorized per17 son, or used for an unauthorized purpose. 

18 (e) OTHER OBLIGATIONS FOLLOWING BREACH.— 

19 (1) IN GENERAL.—A covered entity required to 

20 provide notification under subsection (a) shall, upon 

21 request of an individual whose personal information 

22 was included in the breach of security, provide or ar23 range for the provision of, to each such individual 

24 and at no cost to such individual— 


emcdonald on DSK67QTVN1PROD with BILLS
22 

•HR 4187 IH

1 (A) consumer credit reports from all of the 

2 major consumer reporting agencies beginning 

3 not later than 60 days following the individual’s 

4 request and continuing on a quarterly basis for 

5 a period of 2 years thereafter; or 

6 (B) a credit monitoring or other service 

7 that— 

8 (i) enables consumers to detect the 

9 misuse of their personal information, be10 ginning not later than 60 days following 

11 the individual’s request and continuing for 

12 a period of 2 years; and 

13 (ii) includes monitoring of the individ14 ual’s credit file at all of the major con15 sumer reporting agencies. 

16 (2) LIMITATION.—This subsection shall not 

17 apply if the only personal information which has 

18 been the subject of the security breach is the individ19 ual’s first name or initial and last name, or address, 

20 or phone number, in combination with a credit or 

21 debit card number, and any required security code. 

22 (3) RULEMAKING.—As part of the Commis23 sion’s rulemaking described in subsection (c)(5), the 

24 Commission shall determine the circumstances under 

25 which a covered entity required to provide notificaVerDate Sep 11 2014 05:05 Dec 09, 2015 Jkt 059200 PO 00000 Frm 00022 Fmt 6652 Sfmt 6201 E:\BILLS\H4187.IH H4187

emcdonald on DSK67QTVN1PROD with BILLS
23 

•HR 4187 IH

1 tion under subsection (a) shall provide or arrange 

2 for the provision of free consumer credit reports or 

3 credit monitoring or other service to affected individ4 uals. 

5 (f) EXEMPTION.— 

6 (1) GENERAL EXEMPTION.—A covered entity 

7 shall be exempt from the requirements under this 

8 section if the data containing personal information 

9 that was, or is reasonably believed to have been, ac10 quired or accessed by an unauthorized person, or 

11 used for an unauthorized purpose, is unusable, 

12 unreadable, or indecipherable because of security 

13 technologies or methodologies generally accepted by 

14 experts in the field of information security at the 

15 time the breach of security occurred. This exemption 

16 does not apply with regard to the use of encryption 

17 technology generally accepted by experts in the field 

18 of information security at the time the breach of se19 curity occurred if any cryptographic keys necessary 

20 to enable decryption of such data are also accessed 

21 or acquired without authorization. 

22 (2) FTC GUIDANCE.—Not later than 1 year 

23 after the date of enactment of this Act the Commis24 sion shall issue guidance regarding the application of 

25 the exemption in paragraph (1). 


emcdonald on DSK67QTVN1PROD with BILLS
24 

•HR 4187 IH

1 (g) WEBSITE NOTIFICATION OF FEDERAL TRADE

2 COMMISSION.—If the Commission, upon receiving notifi3 cation of any breach of security that is reported to the 

4 Commission under subsection (d)(1), finds that notifica5 tion of such a breach of security via the Commission’s 

6 Internet website would be in the public interest or for the 

7 protection of consumers, the Commission shall place such 

8 a notification in a clear and conspicuous location on its 

9 Internet website. 

10 (h) WEBSITE NOTIFICATION OF STATE ATTORNEYS

11 GENERAL.—If a State attorney general, upon receiving 

12 notification of any breach of security that is reported to 

13 the Commission under subsection (d)(5), finds that notifi14 cation of such a breach of security via the State attorney 

15 general’s Internet website would be in the public interest 

16 or for the protection of consumers, the State attorney gen17 eral shall place such a notification in a clear and con18 spicuous location on its Internet website. 

19 (i) FTC STUDY ON NOTIFICATION IN LANGUAGES IN

20 ADDITION TO ENGLISH.—Not later than 1 year after the 

21 date of enactment of this Act, the Commission shall con22 duct a study on the practicality and cost effectiveness of 

23 requiring the notification required by subsection (c)(1) to 

24 be provided in a language in addition to English to individ25 uals known to speak only such other language. 


emcdonald on DSK67QTVN1PROD with BILLS
25 

•HR 4187 IH

1 (j) EDUCATION AND OUTREACH FOR SMALL BUSI2 NESSES.—The Commission shall conduct education and 

3 outreach for small business concerns on data security 

4 practices and how to prevent hacking and other unauthor5 ized access to, acquisition of, or use of data maintained 

6 by such small business concerns. 

7 (k) WEBSITE ON DATA SECURITY BEST PRAC8 TICES.—The Commission shall establish and maintain an 

9 Internet website containing nonbinding best practices for 

10 businesses regarding data security and how to prevent 

11 hacking and other unauthorized access to, acquisition of, 

12 or use of data maintained by such businesses. 

13 (l) GENERAL RULEMAKING AUTHORITY.— 

14 (1) IN GENERAL.—The Commission may pro15 mulgate regulations necessary under section 553 of 

16 title 5, United States Code, to effectively enforce the 

17 requirements of this section. 

18 (2) LIMITATION.—In promulgating rules under 

19 this Act, the Commission shall not require the de20 ployment or use of any specific products or tech21 nologies, including any specific computer software or 

22 hardware. 

23 (m) TREATMENT OF PERSONS GOVERNED BY OTHER

24 LAW.—A covered entity who is in compliance with any 

25 other Federal law that requires such covered entity to proVerDate Sep 11 2014 05:05 Dec 09, 2015 Jkt 059200 PO 00000 Frm 00025 Fmt 6652 Sfmt 6201 E:\BILLS\H4187.IH H4187

emcdonald on DSK67QTVN1PROD with BILLS
26 

•HR 4187 IH

1 vide notification to individuals following a breach of secu2 rity in at least the same or substantially similar cir3 cumstances and in at the least same or substantially simi4 lar manner as required to be provided under this Act, shall 

5 be deemed to be in compliance with this section with re6 spect to activities and information covered under such 

7 Federal law. 

8 SEC. 4. APPLICATION AND ENFORCEMENT. 

9 (a) ENFORCEMENT BY THE FEDERAL TRADE COM10 MISSION.— 

11 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC12 TICES.—A violation of section 2 or 3 shall be treated 

13 as an unfair and deceptive act or practice in viola14 tion of a regulation under section 18(a)(1)(B) of the 

15 Federal Trade Commission Act (15 U.S.C. 

16 57a(a)(1)(B)) regarding unfair or deceptive acts or 

17 practices and shall be subject to enforcement by the 

18 Commission under that Act with respect to any cov19 ered entity. All of the functions and powers of the 

20 Commission under the Federal Trade Commission 

21 Act are available to the Commission to enforce com22 pliance by any person with the requirements imposed 

23 under this title, irrespective of whether that person 

24 is engaged in commerce or meets any other jurisdicVerDate Sep 11 2014 05:05 Dec 09, 2015 Jkt 059200 PO 00000 Frm 00026 Fmt 6652 Sfmt 6201 E:\BILLS\H4187.IH H4187

emcdonald on DSK67QTVN1PROD with BILLS
27 

•HR 4187 IH

1 tional tests under the Federal Trade Commission 

2 Act. 

3 (2) COORDINATION WITH FEDERAL COMMU4 NICATIONS COMMISSION.—Where enforcement re5 lates to entities subject to the authority of the Fed6 eral Communications Commission, enforcement ac7 tions by the Commission will be coordinated with the 

8 Federal Communications Commission. 

9 (3) COORDINATION WITH CONSUMER FINANCIAL

10 PROTECTION BUREAU.—Where enforcement relates 

11 to financial information or information associated 

12 with the provision of financial products or services, 

13 enforcement actions by the Commission will be co14 ordinated with the Consumer Financial Protection 

15 Bureau. 

16 (b) ENFORCEMENT BY STATE ATTORNEYS GEN17 ERAL.— 

18 (1) IN GENERAL.—If the chief law enforcement 

19 officer of a State, or an official or agency designated 

20 by a State, has reason to believe that any covered 

21 entity has violated or is violating section 2 or 3 of 

22 this Act, the attorney general, official, or agency of 

23 the State, in addition to any authority it may have 

24 to bring an action in State court under its consumer 

25 protection law, may bring a civil action in any apVerDate Sep 11 2014 05:05 Dec 09, 2015 Jkt 059200 PO 00000 Frm 00027 Fmt 6652 Sfmt 6201 E:\BILLS\H4187.IH H4187

emcdonald on DSK67QTVN1PROD with BILLS
28 

•HR 4187 IH

1 propriate United States district court or in any 

2 other court of competent jurisdiction, including a 

3 State court, to— 

4 (A) enjoin further such violation by the de5 fendant; 

6 (B) enforce compliance with this such sec7 tion; 

8 (C) obtain civil penalties in the amount de9 termined under paragraph (2); and 

10 (D) obtain damages, restitution, or other 

11 compensation on behalf of residents of the 

12 State. 

13 (2) CIVIL PENALTIES.— 

14 (A) CALCULATION.— 

15 (i) TREATMENT OF VIOLATIONS OF

16 SECTION 2.—For purposes of paragraph 

17 (1)(C) with regard to a violation of section 

18 2, the amount determined under this para19 graph is the amount calculated by multi20 plying the number of days that a covered 

21 entity is not in compliance with such sec22 tion by an amount not greater than 

23 $16,500. 

24 (ii) TREATMENT OF VIOLATIONS OF

25 SECTION 3.—For purposes of paragraph 


emcdonald on DSK67QTVN1PROD with BILLS
29 

•HR 4187 IH

1 (1)(C) with regard to a violation of section 

2 3, the amount determined under this para3 graph is the amount calculated by multi4 plying the number of violations of such 

5 section by an amount not greater than 

6 $16,500. Each failure to send notification 

7 as required under section 3 to a resident of 

8 the United States shall be treated as a sep9 arate violation. 

10 (B) ADJUSTMENT FOR INFLATION.—Be11 ginning on the date that the Consumer Price 

12 Index is first published by the Bureau of Labor 

13 Statistics that is after 1 year after the date of 

14 enactment of this Act, and each year thereafter, 

15 the amounts specified in clauses (i) and (ii) of 

16 subparagraph (A) shall be increased by the per17 centage increase in the Consumer Price Index 

18 published on that date from the Consumer 

19 Price Index published the previous year. 

20 (3) NOTICE AND INTERVENTION BY THE

21 FTC.— 

22 (A) The attorney general of a State shall 

23 provide prior written notice of any action under 

24 paragraph (1) to the Commission and provide 

25 the Commission with a copy of the complaint in 


emcdonald on DSK67QTVN1PROD with BILLS
30 

•HR 4187 IH

1 the action, except in any case in which such 

2 prior notice is not feasible, in which case the at3 torney general shall serve such notice imme4 diately upon instituting such action. The Com5 mission shall have the right— 

6 (i) to intervene in the action; 

7 (ii) upon so intervening, to be heard 

8 on all matters arising therein; and 

9 (iii) to file petitions for appeal. 

10 (B) LIMITATION ON STATE ACTION WHILE

11 FEDERAL ACTION IS PENDING.—If the Commis12 sion has instituted a civil action for violation of 

13 this Act, no State attorney general, or official 

14 or agency of a State, may bring an action under 

15 this subsection during the pendency of that ac16 tion against any defendant named in the com17 plaint of the Commission for any violation of 

18 this Act alleged in the complaint. 

19 (4) RELATIONSHIP WITH STATE-LAW CLAIMS.— 

20 If the attorney general of a State has authority to 

21 bring an action under State law directed at acts or 

22 practices that also violate this Act, the attorney gen23 eral may assert the State-law claim and a claim 

24 under this Act in the same civil action. 


emcdonald on DSK67QTVN1PROD with BILLS
31 

•HR 4187 IH

1 SEC. 5. DEFINITIONS. 

2 In this Act: 

3 (1) BREACH OF SECURITY.—The term ‘‘breach 

4 of security’’ means unauthorized access to, acquisi5 tion of, or use of data containing personal informa6 tion. 

7 (2) COMMISSION.—The term ‘‘Commission’’ 

8 means the Federal Trade Commission. 

9 (3) CONSUMER REPORTING AGENCY.—The term 

10 ‘‘consumer reporting agency’’ has the meaning given 

11 that term in section 603 of the Fair Credit Report12 ing Act (15 U.S.C. 1681a). 

13 (4) COVERED ENTITY.—The term ‘‘covered en14 tity’’ means— 

15 (A) any organization, corporation, trust, 

16 partnership, sole proprietorship, unincorporated 

17 association, or venture over which the Commis18 sion has authority pursuant to section 5(a)(2) 

19 of the Federal Trade Commission Act (15 

20 U.S.C. 45(a)(2)); 

21 (B) notwithstanding section 5(a)(2) of the 

22 Federal Trade Commission Act (15 U.S.C. 

23 45(a)(2)), common carriers subject to the Com24 munications Act of 1934 (47 U.S.C. 151 et 

25 seq.); and 


emcdonald on DSK67QTVN1PROD with BILLS
32 

•HR 4187 IH

1 (C) notwithstanding sections 4 and 5(a)(2) 

2 of the Federal Trade Commission Act (15 

3 U.S.C. 44 and 45(a)(2)), any nonprofit organi4 zation, including any organization described in 

5 section 501(c) of the Internal Revenue Code of 

6 1986 that is exempt from taxation under sec7 tion 501(a) of the Internal Revenue Code of 

8 1986. 

9 (5) INFORMATION BROKER.—The term ‘‘infor10 mation broker’’— 

11 (A) means a commercial entity whose busi12 ness is to collect, assemble, or maintain per13 sonal information concerning individuals who 

14 are not current or former customers of such en15 tity in order to sell such information or provide 

16 access to such information to any nonaffiliated 

17 third party in exchange for consideration, 

18 whether such collection, assembly, or mainte19 nance of personal information is performed by 

20 the information broker directly, or by contract 

21 or subcontract with any other entity; and 

22 (B) does not include a commercial entity to 

23 the extent that such entity processes informa24 tion collected by and received from a non25 affiliated third party concerning individuals who 


emcdonald on DSK67QTVN1PROD with BILLS
33 

•HR 4187 IH

1 are current or former customers or employees 

2 of the third party to enable the third party to 

3 provide benefits for the employees or directly 

4 transact business with the customers. 

5 (6) PERSONAL INFORMATION.— 

6 (A) DEFINITION.—The term ‘‘personal in7 formation’’ means any information or compila8 tion of information that includes any of the fol9 lowing: 

10 (i) An individual’s first name or initial 

11 and last name in combination with any 2 

12 or more of the following data elements for 

13 that individual: 

14 (I) Home address or telephone 

15 number. 

16 (II) Mother’s maiden name. 

17 (III) Month, day, and year of 

18 birth. 

19 (IV) User name or electronic 

20 mail address. 

21 (ii) Driver’s license number, passport 

22 number, military identification number, 

23 alien registration number, or other similar 

24 number issued on a government document 

25 used to verify identity. 


emcdonald on DSK67QTVN1PROD with BILLS
34 

•HR 4187 IH

1 (iii) Unique account identifier, includ2 ing a financial account number, or credit 

3 or debit card number, electronic identifica4 tion number, user name, or routing code. 

5 (iv) Partial or complete Social Secu6 rity number. 

7 (v) Unique biometric or genetic data 

8 such as a faceprint, fingerprint, voice 

9 print, a retina or iris image, or any other 

10 unique physical representations. 

11 (vi) Information that could be used to 

12 access an individual’s account, such as 

13 user name and password or email address 

14 and password. 

15 (vii) Any two or more of the following 

16 data elements: 

17 (I) An individual’s first and last 

18 name or first initial and last name. 

19 (II) A unique account identifier, 

20 including a financial account number 

21 or credit or debit card number, elec22 tronic identification number, user 

23 name, or routing code. 

24 (III) Any security code, access 

25 code, or password, or source code that 


emcdonald on DSK67QTVN1PROD with BILLS
35 

•HR 4187 IH

1 could be used to generate such codes 

2 or passwords. 

3 (viii) Information generated or derived 

4 from the operation or use of an electronic 

5 communications device that is sufficient to 

6 identify the street name and name of the 

7 city or town in which the device is located. 

8 (ix) Any information regarding an in9 dividual’s medical history, mental or phys10 ical condition, medical treatment or diag11 nosis by a health care professional, or the 

12 provision of health care to the individual, 

13 including health information provided to a 

14 website or mobile application. 

15 (x) A health insurance policy number 

16 or subscriber identification number and 

17 any unique identifier used by a health in18 surer to identify the individual, or any in19 formation in an individual’s health insur20 ance application and claims history, includ21 ing any appeals records. 

22 (xi) Digitized or other electronic sig23 nature. 


emcdonald on DSK67QTVN1PROD with BILLS
36 

•HR 4187 IH

1 (xii) Nonpublic communications or 

2 other user-created content such as emails, 

3 photographs, or videos. 

4 (xiii) Any record or information con5 cerning payroll, income, financial accounts, 

6 mortgages, loans, lines of credit, utility 

7 bills, accumulated purchases, or any other 

8 information regarding financial assets, ob9 ligations, or spending habits. 

10 (xiv) Any additional element the Com11 mission defines as personal information. 

12 (B) MODIFIED DEFINITION BY RULE13 MAKING.—The Commission may, by rule pro14 mulgated under section 553 of title 5, United 

15 States Code, modify the definition of ‘‘personal 

16 information’’ under subparagraph (A). 

17 (7) STATE.—The term ‘‘State’’ means each of 

18 the several States, the District of Columbia, the 

19 Commonwealth of Puerto Rico, Guam, American 

20 Samoa, the United States Virgin Islands, the Com21 monwealth of the Northern Mariana Islands, any 

22 other territory or possession of the United States, 

23 and each federally recognized Indian tribe. 


emcdonald on DSK67QTVN1PROD with BILLS
37 

•HR 4187 IH

1 SEC. 6. EFFECT ON OTHER LAWS. 

2 (a) PREEMPTION OF STATE DATA SECURITY AND

3 BREACH NOTIFICATION LAWS.—No State or political sub4 division thereof shall have any authority to establish or 

5 continue in effect any standard or requirement relating 

6 to information security practices for the treatment and 

7 protection of personal information as defined in section 

8 5(5)(A) or as subsequently amended by the Federal Trade 

9 Commission under section 5(5)(B), or notification to indi10 viduals of a breach of security of personal information as 

11 defined in section 5(5)(A) or as subsequently amended by 

12 the Federal Trade Commission under section 5(5)(B), 

13 that is not identical to the standards and requirements 

14 established under this Act. 

15 (b) EFFECT ON STATE LAW.—In the case of a provi16 sion of the law of a State that is superseded by subsection 

17 (a), this Act may be enforced in the same manner and 

18 to the same extent as the State law could have been en19 forced under State law. 

20 (c) EFFECT ON OTHER STATE LAWS.—Nothing in 

21 this Act shall be construed to— 

22 (1) preempt or limit any provision of any law, 

23 rule, regulation, requirement, standard, or other pro24 vision having the force and effect of law of any 

25 State, including any State consumer protection law, 


emcdonald on DSK67QTVN1PROD with BILLS
38 

•HR 4187 IH

1 any State law relating to acts of fraud or deception, 

2 and any State trespass, contract, or tort law; 

3 (2) preempt or limit any provision of any law, 

4 rule, regulation, requirement, standard, or other pro5 vision having the force and effect of law of any State 

6 regarding post-data breach services, including secu7 rity or credit freezes, credit monitoring, identity 

8 theft monitoring, and identity theft services; 

9 (3) prevent or limit the attorney general of a 

10 State from exercising the powers conferred upon the 

11 attorney general by the laws of the State, including 

12 conducting investigations, administering oaths or af13 firmations, or compelling the attendance of witnesses 

14 or the production of documentary and other evi15 dence; or 

16 (4) preempt or limit any provision of any law, 

17 rule, regulation, requirement, standard, or other pro18 vision having the force and effect of law of any State 

19 with respect to any person that is not a covered enti20 ty under section 5(4). 

21 (d) PRESERVATION OF AUTHORITY.— 

22 (1) FEDERAL TRADE COMMISSION.—Nothing in 

23 this Act may be construed in any way to limit the 

24 Commission’s authority under any other provision of 

25 law. 


emcdonald on DSK67QTVN1PROD with BILLS
39 

•HR 4187 IH

1 (2) FEDERAL COMMUNICATIONS COMMISSION.— 

2 Nothing in this Act may be construed in any way to 

3 limit or affect the Federal Communications Commis4 sion’s authority under any other provision of law. 

5 (3) CONSUMER FINANCIAL PROTECTION BU6 REAU.—Nothing in this Act may be construed in 

7 any way to limit or affect the Consumer Financial 

8 Protection Bureau’s authority under any other pro9 vision of law. 

10 SEC. 7. EFFECTIVE DATE. 

11 This Act shall take effect 90 days after the date of 

12 enactment of this Act. 

Æ 


emcdonald on DSK67QTVN1PROD with BILLS